ItsDangerous

This is much simpler than JWT; you'd have a hard time to implement this incorrectly as opposed to JWT. I'm not in the loop, but JWT also used to specify an entire tirefire for crypto algorithms. Probably still does.

Re: ItsDangerous

#6

Post by thybag » Fri, Dec 17, 2021, 2:24 PM UTC

formerly_proven wrote: post #5

akavel wrote: post #3

How does this differ from JWT? (sincere question not having deep knowledge about JWT either)

This is much simpler than JWT; you'd have a hard time to implement this incorrectly as opposed to JWT. I'm not in the loop, but JWT also used to specify an entire tirefire for crypto algorithms. Probably still does.

I've used PASETO in place of JWT for this kind of thing before. Interested to know how it compares.

Does this support a known standard, or is it just its own thing.

Re: ItsDangerous

#7

Post by tosh » Fri, Dec 17, 2021, 2:24 PM UTC

diogenesjunior wrote: post #4

I wonder about OP's reasoning for submitting this to HN. `itsdangerous` has been around for a while and is actually required by `flask`.

I am researching best practices for signing of data for web services (in JavaScript) and remembered that I was using a library with flask at a hackathon a few years ago and that it had a sword illustration on the website but couldn’t find it (but eventually did now).

Re: ItsDangerous

#8

Post by ZiiS » Fri, Dec 17, 2021, 2:47 PM UTC

akavel wrote: post #3

How does this differ from JWT? (sincere question not having deep knowledge about JWT either)

It predates JWTs by several years. In practice is is used the same way is as symmetrically signed JWTs though by default with HMAC-SHA-1 vs HMAC-SHA256. It can support a timestamp (`iat` for JWT) to implement expiry but not an actual `exp`; nor `aud` and the other common fields. It also dose not handle encryption or asymmetric signing. Whilst these all sound like drawbacks they do give it simplicity which is also a useful feature.

Re: ItsDangerous

#9

Post by sigmonsays » Fri, Dec 17, 2021, 2:52 PM UTC

[flagged]

Re: ItsDangerous

#10

Post by ZiiS » Fri, Dec 17, 2021, 2:53 PM UTC

formerly_proven wrote: post #5

akavel wrote: post #3

How does this differ from JWT? (sincere question not having deep knowledge about JWT either)

This is much simpler than JWT; you'd have a hard time to implement this incorrectly as opposed to JWT. I'm not in the loop, but JWT also used to specify an entire tirefire for crypto algorithms. Probably still does.

JWT specified all the crypto algorithms; even future ones. They did not intend people to accept more then a very small subset. This was insufficiently well communicated.